[IMP] core: unit test for /web/content as public

This revision adds a unit test for the revision
55a1430016

closes odoo/odoo#113728

odoo/addons/test_http/data.xml

@@ -25,10 +25,12 @@
 
         <record id="milky_way" model="test_http.galaxy">
             <field name="name">Milky Way</field>
+            <field name="picture" type="base64" file="test_http/static/src/img/milky_way.jpg"/>
         </record>
 
         <record id="pegasus" model="test_http.galaxy">
             <field name="name">Pegasus</field>
+            <field name="picture" type="base64" file="test_http/static/src/img/pegasus.jpg"/>
         </record>
 
         <record id="earth" model="test_http.stargate">

odoo/addons/test_http/models.py

@@ -18,6 +18,8 @@ class Stargate(models.Model):
     has_galaxy_crystal = fields.Boolean(store=True, compute='_compute_has_galaxy_crystal', readonly=False)
     glyph_attach = fields.Image(attachment=True)
     glyph_inline = fields.Image(attachment=False)
+    galaxy_picture = fields.Image(related='galaxy_id.picture', attachment=True, store=False)
+
 
     _sql_constraints = [
         ('address_length', 'CHECK(LENGTH(address) = 6)', "Local addresses have 6 glyphs"),
@@ -57,6 +59,7 @@ class Galaxy(models.Model):
     _description = 'Galaxy'
 
     name = fields.Char(required=True, help='The galaxy common name.')
+    picture = fields.Image(attachment=True, groups="base.group_user")
 
     @api.model
     def render(self, galaxy_id):

odoo/addons/test_http/tests/test_static.py

@@ -264,10 +264,20 @@ class TestHttpStatic(TestHttpStaticCommon):
             assert_content=self.gizeh_data[100:200]
         )
 
-    def test_static16_public_user_image(self):
+    def test_static16_public_access_rights(self):
         public_user = self.env.ref('base.public_user')
-        res = self.url_open(f'/web/image/res.users/{public_user.id}/image_128?download=1')
-        self.assertEqual(res.status_code, 404)
+
+        with self.subTest('model access rights'):
+            res = self.url_open(f'/web/content/res.users/{public_user.id}/image_128')
+            self.assertEqual(res.status_code, 404)
+
+        with self.subTest('attachment + field access rights'):
+            res = self.url_open('/web/content/test_http.pegasus?field=picture')
+            self.assertEqual(res.status_code, 404)
+
+        with self.subTest('related attachment + field access rights'):
+            res = self.url_open('/web/content/test_http.earth?field=galaxy_picture')
+            self.assertEqual(res.status_code, 404)
 
 
 @tagged('post_install', '-at_install')